SAP Security Patch Day – February 2026

HotNews

Let’s start with HotNews, the highest-priority category. There are 3 notes in total — 2 newly released today and 1 minor update.

3697099 — CRM & S/4HANA Scripting Editor: allowlist bypass enables critical function execution (incl. SQL)

An authenticated attacker can abuse a generic function module and execute arbitrary SQL statements. In essence, that is a full database compromise with broad impact on confidentiality, integrity, and availability. SAP’s patch hardens the logic with additional allowlist checks to prevent arbitrary FM calls. A workaround is available by deactivating the affected SICF services but the actual fix is provided by the patch. See also the FAQ note 3709553.

3674774 — NetWeaver AS ABAP / ABAP Platform: background RFC can bypass required S_RFC authorization

A low-privileged authenticated user can perform background RFC operations without the required S_RFC authorization. This can lead to a serious impact on integrity and availability. Kernel patches are released for basically all supported ABAP kernels from kernel version 7.22 – 9.16. Take note of the patching instructions, this is not a kernel patch to just apply and restart! Additional S_RFC permissions may be required for users. See FAQ note 3676372 for detailed instructions.

3697979 — SAP Landscape Transformation: code/OS command injection via RFC-exposed module

SecurityBridge proudly reported this vulnerability and the patch was first released as part of the January 2026 cycle. For this month, the update concerns a minor change (externally reported: yes). No new actions required from customers. 

High-Priority Notes

We have 7 High-priority notes this month which have all been newly released. Although these are 1 category below HotNews, they are still important. We highlight the following notes below:

3692405 — SAP Commerce Cloud: outbound SSL trust validation bypass 

In SAP Commerce Cloud, under certain conditions, an authenticated user can exploit a so-called ‘race condition’ in the Jersey library (CVE-2025-12383). This leads to bypass of the SSL trust validation for outbound connections, creating a high confidentiality/integrity risk. Note that this is only relevant for custom extensions as the standard SAP configuration does not use Jersey for outbound connections.

Business Objects platform

The following high notes concern the Business Objects platform:

3654236 — BusinessObjects BI Platform: unauthenticated DoS via trusted  endpoint

A remote attacker can trigger an availability failure against a BI Platform endpoint in a way that breaks the trust/authentication flow and locks out legitimate users. 

3678282 — BusinessObjects BI Platform: unauthenticated DoS (CMS crash/restart loop)

Another BusinessObjects availability problem but with a particularly practical failure mode: specially crafted requests can crash and auto-restart the CMS, and repeating them can keep the CMS persistently down. There is a workaround but patching is – as always recommended. See also note 3695912 for a similar DoS vulnerability on this platform.

3674246 — BusinessObjects BI Platform: open redirect (malicious URL insertion + user click)

An authenticated attacker with high privileges can insert a malicious URL and eventually download malicious content. SAP mitigates this by implementing server-side whitelisting to prevent unvalidated redirects.

Medium- and Low-Priority Notes

This Patch Tuesday, 19 notes fall into the Medium or Low category. See below for some highlights and for a full breakdown, scroll to the end of this post.

3679346 — SAP Business One client: credentials may be exposed in memory dump files

Dump files can contain credentials without proper obfuscation, so if an attacker obtains these dumps they may gain unauthorized access and the ability to perform unauthorized operations. With the patch, SAP reduces the risk by ensuring credentials are no longer stored in process memory. 

Note: additional security measures are listed which are highly recommended to consider!

3678313 — Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)

This note describes another memory-related issue, where memory content can be  accessed and used for further exploitation. The kernel patch fixes this issue.